Shredder: Learning Noise Distributions to Protect Inference Privacy

By Fatemehsadat Mireshghallah, Mohammadkazem Taram, Prakash Ramrakhyani, Dean M. Tullsen, Hadi Esmaeilzadeh. 2019

113 citations recorded by the source corpus.

A wide variety of deep neural applications increasingly rely on the cloud to perform their compute-heavy inference. This common practice requires sending private and privileged data over the network to remote servers, exposing it to the service provider and potentially compromising its privacy. Even if the provider is trusted, the data can still be vulnerable over communication channels or via side-channel attacks in the cloud. To that end, this paper aims to reduce the information content of the communicated data with as little as possible compromise on the inference accuracy by making the sent data noisy. An undisciplined addition of noise can significantly reduce the accuracy of inference, rendering the service unusable. To address this challenge, this paper devises Shredder, an end-to-end framework, that, without altering the topology or the weights of a pre-trained network, learns additive noise distributions that significantly reduce the information content of communicated data while maintaining the inference accuracy. The key idea is finding the additive noise distributions by casting it as a disjoint offline learning process with a loss function that strikes a balance between accuracy and information degradation. The loss function also exposes a knob for a disciplined and controlled asymmetric trade-off between privacy and accuracy. While keeping the DNN intact, Shredder divides inference between the cloud and the edge device, striking a balance between computation and communication. In the separate phase of inference, the edge device takes samples from the Laplace distributions that were collected during the proposed offline learning phase and populates a noise tensor with these sampled elements. Then, the edge device merely adds this populated noise tensor to the intermediate results to be sent to the cloud. As such, Shredder enables accurate inference on noisy intermediate data without the need to update the model or the cloud, or any training process during inference. We also formally show that Shredder maximizes privacy with minimal impact on DNN accuracy while the tradeoff between privacy and accuracy is controlled through a mathematical knob. Experimentation with six real-world DNNs from text processing and image classification shows that Shredder reduces the mutual information between the input and the communicated data to the cloud by 74.70% compared to the original execution while only sacrificing 1.58% loss in accuracy. On average, Shredder also offers a speedup of 1.79x over Wi-Fi and 2.17x over LTE compared to cloud-only execution when using an off-the-shelf mobile GPU (Tegra X2) on the edge.

Subfields: Artificial Intelligence, Computer Vision and Pattern Recognition

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

In Computer Vision and Pattern Recognition

Citations in the corpus

NoPeek: Information leakage reduction to share activations in distributed deep learning (2020, background): “The work in [27] considers protection of intermediate activations under this attack setting solely for private inference via learning of specific noise distributions to perturb the activations prior to communication.”
Cheetah: Optimizing and Accelerating Homomorphic Encryption for Private Inference (2020, background): “Others have looked at limiting information leakage by adding noise (similar to DP) [40]; this provides increased average-case privacy with negligible loss in accuracy.”
The Deep Learning Compiler: A Comprehensive Survey (2020, unknown): “To protect privacy in edge-cloud system, existing approaches [73], [74], [75] propose to add noise with special statistic properties to the intermediate results that can reduce the accuracy of the attacker task without severely”
Privacy-Preserving Inference in Machine Learning Services Using Trusted Execution Environments (2019, background): “Shredder [27] partitions the DNN models between the edge and the cloud, and adds learned noise to the intermediate data at the edge before offloading to the cloud.”
DarKnight: A Data Privacy Scheme for Training and Inference of Deep Neural Networks (2020, background): “Inference FHME[19], MiniONN [20], CryptoNets[21], Gazelle[22] SGXCMP[23], SecureML[24] Mlcapsule[7], ObliviousTEE[8], P-TEE[9], Slalom[10] Arden [25], NOffload[26], Shredder [27]”